The Data Protection Board: Inquiries, Penalties and Appeals

Introduction

The Digital Personal Data Protection Act, 2023 (the DPDP Act) is enforced by a single body, the Data Protection Board of India. When a data principal (the person the data is about) complains, or a data fiduciary (the organisation that decides how the data is used) reports a breach, the matter goes to the Board. Penalties it imposes go to the Consolidated Fund of India (s.34), not to the complainant.

As of October 2026 the Board exists in law but has no members. Its procedure is already set out in the Act and Rules 17 to 22 of the DPDP Rules, 2025. This article follows a complaint from start to finish.

The legal position

Establishment and membership. The Board was established under section 18 as a body corporate (G.S.R. 844(E)). Section 19 provides for a Chairperson and as many Members as the Government notifies; a Lok Sabha answer of 12 August 2026 gives the strength as a Chairperson and four Members. Members need expertise in fields such as data governance, dispute resolution, technology or law, and at least one must be a legal expert. They serve two-year terms and may be re-appointed (s.20), can be removed only after a hearing (s.21) and are public servants when acting under the Act (s.25).

Appointment. Rule 17 creates two search-cum-selection committees: one chaired by the Cabinet Secretary for the Chairperson, and one chaired by the Secretary of the Ministry of Electronics and Information Technology (MeitY) for other Members. Under Rule 18 and the Fifth Schedule, consolidated monthly pay is ₹4,50,000 for the Chairperson and ₹4,00,000 for each Member.

Status. MeitY invited applications on 6 May 2026. The 12 August 2026 answer described the selection process but reported no appointment. We found no appointment notified since then.

Functions (s.27). The Board acts on (a) a fiduciary's breach intimation, where it may also direct urgent remedial measures; (b) a data principal's complaint about a breach or her rights, a reference from the Central or a State Government, or a court's direction; (c) and (d) consent manager complaints and registration breaches; and (e) a Government reference about an intermediary ignoring a blocking order. It may issue binding directions after a hearing (s.27(2)) and later modify or cancel them (s.27(3)).

Commencement. Sections 18 to 26 and 39, and Rules 17 to 21, are in force. Section 27(1)(d) starts on 13 November 2026. The rest of section 27, sections 28 to 34 and 37, and Rule 22 start on 13 May 2027.

Analysis

A digital office with civil-court powers, but no raids

Section 28(1) requires the Board to act as an independent body and, as far as practicable, as a digital office, with complaints, hearings and decisions "digital by design". Rule 20 lets it run proceedings without anyone's physical presence.

In an inquiry, section 28(7) gives the Board a civil court's powers to summon and examine people on oath, require documents and inspect "any data, book, document, register, books of account". Section 28(8) sets the limit: the Board may not prevent access to premises or take custody of equipment in a way that may adversely affect a person's day-to-day functioning. It may call on police and government officers for help (s.28(9)) and issue interim orders after a hearing (s.28(10)).

Filters before and during an inquiry

In our view the Board cannot act on its own motion: section 28(2) ties its action to the triggers in section 27(1).

A data principal must first exhaust the fiduciary's grievance process (s.13(3)); Rule 14 gives the fiduciary up to 90 days to respond. The Board then decides whether there are "sufficient grounds" to inquire. If not, it may close the proceedings with recorded reasons (s.28(4)); it may also close them after inquiry and a hearing (s.28(11)). At any stage it may warn or impose costs on a complainant whose complaint is "false or frivolous" (s.28(12)), and section 15(d) makes filing one a breach of the data principal's own duties.

A six-month clock

Rule 19(9) requires the Board to complete an inquiry within six months of receiving the intimation, complaint, reference or direction. It may extend that period, with recorded reasons, "for a further period not exceeding three months at a time". Extensions are not capped in number.

Settling: mediation and voluntary undertakings

If the Board thinks a complaint can be resolved by mediation, it may direct the parties to try it (s.31). At any stage of a section 28 proceeding, it may also accept a voluntary undertaking to act within a set time, to refrain from an action, or to publicise the undertaking (s.32). Acceptance bars further proceedings on the matters it covers. A breach of the undertaking counts as a breach of the Act, with a penalty up to the maximum for the original breach (Schedule, item 6).

Penalties: significance first, then calibration

Section 33(1) allows a penalty only where the Board finds, after a hearing, that a breach is "significant". In fixing the amount it must consider (s.33(2)):

• the nature, gravity and duration of the breach;
• the type and nature of the personal data affected;
• whether the breach is repetitive;
• whether the person gained, or avoided a loss, as a result;
• any mitigation, and how timely and effective it was;
• whether the penalty is proportionate and effective as a deterrent; and
• the likely impact of the penalty on the person penalised.

The Schedule sets a separate maximum for each obligation, from ₹250 crore for security safeguards down to ₹10,000 for a data principal's duties.

Appeals and the courts

Anyone aggrieved by a Board order or direction may appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days of receiving it; late appeals may be admitted for sufficient cause (s.29(2)–(3)). Rule 22 requires digital filing, with the fee that applies to appeals under the TRAI Act, 1997, payable by UPI. TDSAT must "endeavour" to decide within six months and record reasons if it cannot (s.29(6)–(7)).

A further appeal lies to the Supreme Court under section 18 of the TRAI Act (s.29(9)): within 90 days, on the grounds in section 100 of the Code of Civil Procedure. TDSAT's orders are executable as civil-court decrees (s.30). The Act does not say how an unappealed Board order is executed; in our view rules or an amendment will need to fill that gap.

Section 39 bars civil courts from matters within the Board's powers and bars injunctions against action under the Act. It cannot remove writ jurisdiction: in L. Chandra Kumar v Union of India, (1997) 3 SCC 261, the Supreme Court held judicial review under Articles 226 and 32 to be part of the basic structure. In our view High Courts will usually send parties to TDSAT first, but a writ remains open for jurisdictional or procedural failures, including delay while the Board has no members.

Repeat offenders

Where the Board has penalised a fiduciary in two or more instances, it may refer the case to the Central Government, advising that public access to the fiduciary's service be blocked. The Government must give a hearing and record reasons before ordering a block (s.37).

Practical implications

From grievance to Supreme Court

Worked example. An ed-tech company runs a live doubt-solving app for Classes 9 to 12. A parent withdraws consent and closes her 15-year-old's account. Months later she learns that the child's chat transcripts and voice notes are still held and were used to fine-tune the app's tutoring chatbot. As the parent she is the data principal for the child's data (s.2(j)).

1. 1.Grievance. She asks for erasure and for the names of everyone who received the data. The company replies in 25 days: raw files deleted and two processors named, but the trained model kept. She complains to the Board.
2. 2.Scrutiny. The Board finds sufficient grounds. Section 8(7) requires erasure on withdrawal, including by processors. The residual Schedule maximum is ₹50 crore; in our view, if the Board treats continued use of a child's data without parental consent as a section 9(1) breach, the ceiling is ₹200 crore.
3. 3.Response. The company shows that transcripts from 2,600 closed accounts sat in one training set for five months (illustrative figures), that no output disclosed them, and that closed accounts now feed its deletion pipeline.
4. 4.Undertaking. It offers to retire the model version, retrain without the data within 90 days, obtain processors' erasure certificates and report completion to the Board. Acceptance ends proceedings on those matters; missing the deadline would revive them (s.32(5)).
5. 5.Otherwise, limited duration, no disclosure and prompt remediation would weigh under s.33(2), and any adverse order could go to TDSAT.

Trayambic's article on children's data in schools and ed-tech, and its ed-tech impact study, cover the underlying section 9 duties.

Checklist

Key takeaways

The Board will be a digital, inquiry-led regulator with civil-court powers but, in our view, no power to raid or act on its own motion. Complaints reach it only after a business's own grievance process, the first line of defence. Penalties need a significant breach and are calibrated by seven statutory factors, so prompt, documented remediation matters. None of this operates until members are appointed and the provisions commence on 13 May 2027.

• The Data Protection Board was established on paper in November 2025 but had no members as of October 2026; its inquiry and penalty provisions commence on 13 May 2027.
• A data principal must exhaust the business's grievance process first; the Board can close a complaint for insufficient grounds (s.28(4)) or after inquiry (s.28(11)).
• Rule 19(9) gives the Board six months to finish an inquiry, extendable by up to three months at a time with recorded reasons.
• Penalties need a 'significant' breach and are set by seven s.33(2) factors; voluntary undertakings under s.32 can end proceedings.
• Appeals go to TDSAT within 60 days and then to the Supreme Court; s.39 bars civil suits but not writ petitions.